Re: [Qemu-devel] [PATCH] slirp: fixed potential use-after-free of a socket

2013-02-22 Thread Jan Kiszka
On 2013-02-22 10:57, Vitaly Chipounov wrote: > Hi, > > On 21.02.2013 15:33, Jan Kiszka wrote: >> On 2013-02-15 12:00, Vitaly Chipounov wrote: >>> A socket may still have references to it in various queues >>> at the time it is freed, causing memory corruptions. >> Did you see it in practice? Or is

Re: [Qemu-devel] [PATCH] slirp: fixed potential use-after-free of a socket

2013-02-22 Thread Vitaly Chipounov
Hi, On 21.02.2013 15:33, Jan Kiszka wrote: > On 2013-02-15 12:00, Vitaly Chipounov wrote: >> A socket may still have references to it in various queues >> at the time it is freed, causing memory corruptions. > Did you see it in practice? Or is this patch based on code review? What > will happen if

Re: [Qemu-devel] [PATCH] slirp: fixed potential use-after-free of a socket

2013-02-21 Thread mdroth
On Thu, Feb 21, 2013 at 03:47:25PM -0600, mdroth wrote: > On Fri, Feb 15, 2013 at 12:00:13PM +0100, Vitaly Chipounov wrote: > > A socket may still have references to it in various queues > > at the time it is freed, causing memory corruptions. > > > > Signed-off-by: Vitaly Chipounov Meant to cc

Re: [Qemu-devel] [PATCH] slirp: fixed potential use-after-free of a socket

2013-02-21 Thread mdroth
On Fri, Feb 15, 2013 at 12:00:13PM +0100, Vitaly Chipounov wrote: > A socket may still have references to it in various queues > at the time it is freed, causing memory corruptions. > > Signed-off-by: Vitaly Chipounov > --- > slirp/socket.c | 29 + > 1 file changed,

Re: [Qemu-devel] [PATCH] slirp: fixed potential use-after-free of a socket

2013-02-21 Thread Jan Kiszka
On 2013-02-15 12:00, Vitaly Chipounov wrote: > A socket may still have references to it in various queues > at the time it is freed, causing memory corruptions. Did you see it in practice? Or is this patch based on code review? What will happen if those queued mbufs find their ifq_so NULL? > > S

[Qemu-devel] [PATCH] slirp: fixed potential use-after-free of a socket

2013-02-15 Thread Vitaly Chipounov
A socket may still have references to it in various queues at the time it is freed, causing memory corruptions. Signed-off-by: Vitaly Chipounov --- slirp/socket.c | 29 + 1 file changed, 29 insertions(+) diff --git a/slirp/socket.c b/slirp/socket.c index 77b0c98..8